diff --git a/stand/efi/boot1/Makefile b/stand/efi/boot1/Makefile
index 39dc4f8e70ad..af03e395b2a5 100644
--- a/stand/efi/boot1/Makefile
+++ b/stand/efi/boot1/Makefile
@@ -1,100 +1,102 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 BOOT1?=		boot1
 PROG=		${BOOT1}.sym
 INTERNALPROG=
 WARNS?=		6
 
 CFLAGS+=	-DEFI_BOOT1
 # We implement a slightly non-standard %S in that it always takes a
 # CHAR16 that's common in UEFI-land instead of a wchar_t. This only
 # seems to matter on arm64 where wchar_t defaults to an int instead
 # of a short. There's no good cast to use here so just ignore the
 # warnings for now.
 CWARNFLAGS.proto.c+=	-Wno-format
 CWARNFLAGS.boot1.c+=	-Wno-format
 
 # Disable bogus alignment issues
 CWARNFLAGS.ufs_module.c += -Wno-format
 CWARNFLAGS.ufs_module.c += -Wno-cast-align
 
 # Disable warnings that are currently incompatible with the zfs boot code
 CWARNFLAGS.zfs_module.c += -Wno-array-bounds
 CWARNFLAGS.zfs_module.c += -Wno-cast-align
 CWARNFLAGS.zfs_module.c += -Wno-cast-qual
 CWARNFLAGS.zfs_module.c += -Wno-missing-prototypes
 CWARNFLAGS.zfs_module.c += -Wno-sign-compare
 CWARNFLAGS.zfs_module.c += -Wno-unused-parameter
 CWARNFLAGS.zfs_module.c += -Wno-unused-function
 
 # architecture-specific loader code
 SRCS+=	boot1.c proto.c self_reloc.c start.S ufs_module.c devpath.c
 .if ${MK_LOADER_ZFS} != "no"
 SRCS+=		zfs_module.c
 CFLAGS.zfs_module.c+=	-I${ZFSSRC}
 CFLAGS.zfs_module.c+=	-I${SYSDIR}/cddl/boot/zfs
 CFLAGS.zfs_module.c+=	-I${SYSDIR}/crypto/skein
 CFLAGS.zfs_module.c+=	-I${SYSDIR}/contrib/openzfs/include
 CFLAGS.zfs_module.c+=	-I${SYSDIR}/contrib/openzfs/include/os/freebsd/spl
 CFLAGS.zfs_module.c+=	-I${SYSDIR}/contrib/openzfs/include/os/freebsd/zfs
 CFLAGS.zfs_module.c+=	-I${SYSDIR}/cddl/contrib/opensolaris/common/lz4
 CFLAGS.zfs_module.c+=	-include ${ZFSOSINC}/spl/sys/ccompile.h
 
 CFLAGS+=	-DEFI_ZFS_BOOT
 .endif
 
 CFLAGS+=	-I${EFIINC}
 CFLAGS+=	-I${EFIINCMD}
 CFLAGS+=	-I${SYSDIR}/contrib/dev/acpica/include
 CFLAGS+=	-DEFI_UFS_BOOT
 .ifdef(EFI_DEBUG)
 CFLAGS+=	-DEFI_DEBUG
 .endif
 
+.include	"${BOOTSRC}/veriexec.mk"
+
 # Always add MI sources and REGULAR efi loader bits
 .PATH:		${EFISRC}/loader/arch/${MACHINE}
 .PATH:		${EFISRC}/loader
 .PATH:		${LDRSRC}
 .PATH:		${EFISRC}/libefi
 CFLAGS+=	-I${LDRSRC}
 
 FILES=	${BOOT1}.efi
 FILESMODE_${BOOT1}.efi=	${BINMODE}
 
 LDSCRIPT=	${EFISRC}/loader/arch/${MACHINE}/ldscript.${MACHINE}
 LDFLAGS+=	-Wl,-T${LDSCRIPT},-Bsymbolic,-znotext -pie
 
 .if ${MACHINE_CPUARCH} == "aarch64"
 CFLAGS+=	-mgeneral-regs-only
 .endif
 .if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_CPUARCH} == "i386"
 CFLAGS+=	-fPIC
 LDFLAGS+=	-Wl,-znocombreloc
 .endif
 
 LIBEFI=		${BOOTOBJ}/efi/libefi/libefi.a
 
 #
 # Add libstand for the runtime functions used by the compiler - for example
 # __aeabi_* (arm) or __divdi3 (i386).
 # as well as required string and memory functions for all platforms.
 #
 DPADD+=		${LIBEFI} ${LIBSA}
 LDADD+=		${LIBEFI} ${LIBSA}
 
 DPADD+=		${LDSCRIPT}
 
 ${BOOT1}.efi: ${PROG}
 	if ${NM} ${.ALLSRC} | grep ' U '; then \
 		echo "Undefined symbols in ${.ALLSRC}"; \
 		exit 1; \
 	fi
 	SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} \
 	${OBJCOPY} -j .peheader -j .text -j .sdata -j .data \
 		-j .dynamic -j .dynsym -j .rel.dyn \
 		-j .rela.dyn -j .reloc -j .eh_frame \
 		--output-target=${EFI_TARGET} ${.ALLSRC} ${.TARGET}
 
 .include <bsd.prog.mk>
diff --git a/stand/efi/fdt/Makefile b/stand/efi/fdt/Makefile
index 8166f481dc99..7f69ce1b3f11 100644
--- a/stand/efi/fdt/Makefile
+++ b/stand/efi/fdt/Makefile
@@ -1,22 +1,24 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 .PATH: ${LDRSRC}
 
 LIB=		efi_fdt
 WARNS?=		6
 
 SRCS=		efi_fdt.c
 
+.include	"${BOOTSRC}/veriexec.mk"
+
 # EFI library headers
 CFLAGS+=	-I${EFISRC}/include
 CFLAGS+=	-I${EFISRC}/include/${MACHINE}
 
 # libfdt headers
 CFLAGS+=	-I${FDTSRC}
 
 # Pick up the bootstrap header for some interface items
 CFLAGS+=	-I${LDRSRC}
 
 .include <bsd.lib.mk>
diff --git a/stand/efi/libefi/Makefile b/stand/efi/libefi/Makefile
index e838a5a10ac4..99b31338a75d 100644
--- a/stand/efi/libefi/Makefile
+++ b/stand/efi/libefi/Makefile
@@ -1,70 +1,72 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 LIB=	efi
 WARNS?=	2
 
 SRCS=	delay.c \
 	devicename.c \
 	devpath.c \
 	efi_console.c \
 	efi_driver_utils.c \
 	efichar.c \
 	efienv.c \
 	efihttp.c \
 	efinet.c \
 	efipart.c \
 	efizfs.c \
 	env.c \
 	errno.c \
 	handles.c \
 	libefi.c \
 	wchar.c
 
 .PATH:  ${SYSDIR}/teken
 SRCS+=  teken.c
 
 .if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_CPUARCH} == "i386"
 SRCS+=	time.c
 .elif ${MACHINE_CPUARCH} == "aarch64" || ${MACHINE_CPUARCH} == "arm" || \
     ${MACHINE_CPUARCH} == "riscv"
 SRCS+=	time_event.c
 .endif
 
 # We implement a slightly non-standard %S in that it always takes a
 # CHAR16 that's common in UEFI-land instead of a wchar_t. This only
 # seems to matter on arm64 where wchar_t defaults to an int instead
 # of a short. There's no good cast to use here so just ignore the
 # warnings for now.
 CWARNFLAGS.efinet.c+=	-Wno-format
 CWARNFLAGS.efipart.c+=	-Wno-format
 CWARNFLAGS.env.c+=	-Wno-format
 
 .if ${MACHINE_CPUARCH} == "aarch64"
 CFLAGS+=	-mgeneral-regs-only
 .endif
 .if ${MACHINE_ARCH} == "amd64"
 CFLAGS+= -fPIC -mno-red-zone
 .endif
 CFLAGS+= -I${EFIINC}
 CFLAGS+= -I${EFIINCMD}
 CFLAGS.efi_console.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
 CFLAGS.efi_console.c+= -I${.CURDIR}/../loader
 CFLAGS.teken.c+= -I${SRCTOP}/sys/teken
 .if ${MK_LOADER_ZFS} != "no"
 CFLAGS+=	-I${ZFSSRC}
 CFLAGS+=	-I${SYSDIR}/cddl/boot/zfs
 CFLAGS+=	-I${SYSDIR}/cddl/contrib/opensolaris/uts/common
 CFLAGS+=	-DEFI_ZFS_BOOT
 .endif
 
 # Pick up the bootstrap header for some interface items
 CFLAGS+= -I${LDRSRC}
 
 # Handle FreeBSD specific %b and %D printf format specifiers
 CFLAGS+= ${FORMAT_EXTENSIONS}
 
 CFLAGS+= -DTERM_EMU
 
+.include "${BOOTSRC}/veriexec.mk"
+
 .include <bsd.lib.mk>
diff --git a/stand/fdt/Makefile b/stand/fdt/Makefile
index 3eee143a9433..e0fd2dbb4e8d 100644
--- a/stand/fdt/Makefile
+++ b/stand/fdt/Makefile
@@ -1,20 +1,22 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 .PATH:		${SYSDIR}/contrib/libfdt/
 
 LIB=		fdt
 
 # Vendor sources of libfdt.
 SRCS+=		fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c \
 		fdt_empty_tree.c fdt_addresses.c fdt_overlay.c
 
 # Loader's fdt commands extension sources.
 SRCS+=		fdt_loader_cmd.c
 
 CFLAGS+=	-I${SYSDIR}/contrib/libfdt/ -I${LDRSRC}
 
 CFLAGS+=	-Wformat -Wall
 
+.include "${BOOTSRC}/veriexec.mk"
+
 .include <bsd.lib.mk>
diff --git a/stand/ficl.mk b/stand/ficl.mk
index caa4aab951c3..2adbccb34f9d 100644
--- a/stand/ficl.mk
+++ b/stand/ficl.mk
@@ -1,22 +1,20 @@
 # $FreeBSD$
 
 # Common flags to build FICL related files
 
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 1
 FICL_CPUARCH=	i386
 .elif ${MACHINE_ARCH:Mmips64*} != ""
 FICL_CPUARCH=	mips64
 .else
 FICL_CPUARCH=	${MACHINE_CPUARCH}
 .endif
 
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 0
 CFLAGS+=	-fPIC
 .endif
 
 CFLAGS+=	-I${FICLSRC} -I${FICLSRC}/${FICL_CPUARCH} -I${LDRSRC}
 CFLAGS+=	-DBF_DICTSIZE=30000
 
-.if ${MK_LOADER_VERIEXEC} != "no"
-CFLAGS+= -DLOADER_VERIEXEC -I${SRCTOP}/lib/libsecureboot/h
-.endif
+.include	"${BOOTSRC}/veriexec.mk"
diff --git a/stand/i386/libfirewire/Makefile b/stand/i386/libfirewire/Makefile
index 6a34efd0acb3..bf42c26a918f 100644
--- a/stand/i386/libfirewire/Makefile
+++ b/stand/i386/libfirewire/Makefile
@@ -1,18 +1,20 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 LIB=		firewire
 
 .PATH:		${SYSDIR}/dev/dcons ${SYSDIR}/dev/firewire
 SRCS+=		firewire.c fwohci.c dconsole.c
 SRCS+=		dcons.c fwcrom.c
 
+.include	"${BOOTSRC}/veriexec.mk"
+
 CFLAGS+=	-D_BOOT
 
 CFLAGS+=	-I${LDRSRC}
 CFLAGS+=	-I${BOOTSRC}/i386/libi386
 
 CFLAGS+=	-Wformat -Wall
 
 .include <bsd.lib.mk>
diff --git a/stand/i386/libi386/Makefile b/stand/i386/libi386/Makefile
index 3dea78f16929..1b23cd53d137 100644
--- a/stand/i386/libi386/Makefile
+++ b/stand/i386/libi386/Makefile
@@ -1,52 +1,54 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 LIB=			i386
 
 SRCS=	bio.c biosacpi.c biosdisk.c biosmem.c biospnp.c \
 	biospci.c biossmap.c bootinfo.c bootinfo32.c bootinfo64.c \
 	comconsole.c devicename.c elf32_freebsd.c \
 	elf64_freebsd.c multiboot.c multiboot_tramp.S relocater_tramp.S \
 	i386_copy.c i386_module.c nullconsole.c pxe.c pxetramp.S \
 	time.c vidconsole.c vbe.c amd64_tramp.S spinconsole.c
 .PATH:	${ZFSSRC}
 SRCS+=  devicename_stubs.c
 CFLAGS+= -I${ZFSSRC}
 
 .PATH:	${SYSDIR}/teken
 SRCS+=	teken.c
 
+.include "${BOOTSRC}/veriexec.mk"
+
 BOOT_COMCONSOLE_PORT?= 0x3f8
 CFLAGS+=	-DCOMPORT=${BOOT_COMCONSOLE_PORT}
 
 BOOT_COMCONSOLE_SPEED?= 9600
 CFLAGS+=	-DCOMSPEED=${BOOT_COMCONSOLE_SPEED}
 
 .ifdef(BOOT_BIOSDISK_DEBUG)
 # Make the disk code more talkative
 CFLAGS+= -DDISK_DEBUG
 .endif
 
 # terminal emulation
 .if ${BOOT_FRAMEBUFFER_MODE:Uno} == "yes"
 CFLAGS.vidconsole.c+= -DFRAMEBUFFER_MODE
 .endif
 CFLAGS.vidconsole.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
 CFLAGS.teken.c+= -I${SRCTOP}/sys/teken
 CFLAGS.bootinfo.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
 CFLAGS.vbe.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
 
 # XXX: make alloca() useable
 CFLAGS+= -Dalloca=__builtin_alloca
 
 CFLAGS+=	-I${BOOTSRC}/ficl -I${BOOTSRC}/ficl/i386 \
 		-I${LDRSRC} -I${BOOTSRC}/i386/common \
 		-I${SYSDIR}/cddl/boot/zfs \
 		-I${SYSDIR}/cddl/contrib/opensolaris/uts/common \
 		-I${SYSDIR}/contrib/dev/acpica/include
 
 # Handle FreeBSD specific %b and %D printf format specifiers
 CFLAGS+= ${FORMAT_EXTENSIONS}
 
 .include <bsd.lib.mk>
diff --git a/stand/liblua/Makefile b/stand/liblua/Makefile
index 68fa2da64fdb..385f1493bd38 100644
--- a/stand/liblua/Makefile
+++ b/stand/liblua/Makefile
@@ -1,47 +1,46 @@
 # $FreeBSD$
 
 .include <bsd.init.mk>
 
 .PATH:		${LUASRC}
 .PATH:		${LIBLUASRC}
 
 .include	"${BOOTSRC}/lua.mk"
 
 LIB=		lua
 INTERNALLIB=
 
 # Core Lua.
 SRCS=	lapi.c lcode.c lctype.c ldebug.c ldo.c ldump.c lfunc.c lgc.c llex.c \
 	lmem.c lobject.c lopcodes.c lparser.c lstate.c lstring.c ltable.c \
         ltm.c lundump.c lvm.c lzio.c
 SRCS+=	lauxlib.c lbaselib.c lstrlib.c loadlib.c
 
 # These aren't yet included, but link now, omitting them saves 15k
 #SRCS+=	lcorolib.c ldblib.c lutf8lib.c
 
 # These aren't yet compatible with the boot environment, and some may never be
 #SRCS+=	lbitlib.c liolib.c lmathlib.c loslib.c ltablib.c
 
 # Our utilities.
 SRCS+=	lerrno.c lpager.c lstd.c lutils.c
 
 .PATH:	${FLUASRC}/modules
 SRCS+=	lfs.c
 
 WARNS?=	3
 
 CFLAGS+= -DLUA_PATH=\"${LUAPATH}\" -DLUA_PATH_DEFAULT=\"${LUAPATH}/\?.lua\"
 CFLAGS+= -ffreestanding -nostdlib -DLUA_USE_POSIX
 CFLAGS+= -fno-stack-protector -D__BSD_VISIBLE
 CFLAGS+= -I${BOOTSRC}/include -I${LIBLUASRC} -I${LUASRC} -I${LDRSRC}
 
 CFLAGS.lutils.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
 
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 0
 CFLAGS+=	-fPIC
 .endif
-.if ${MK_LOADER_VERIEXEC} == "yes"
-CFLAGS+= -I${SRCTOP}/lib/libsecureboot/h -DLOADER_VERIEXEC
-.endif
+
+.include "${BOOTSRC}/veriexec.mk"
 
 .include <bsd.lib.mk>
diff --git a/stand/loader.mk b/stand/loader.mk
index 3a38a9bc9e63..9dda8c6535ea 100644
--- a/stand/loader.mk
+++ b/stand/loader.mk
@@ -1,196 +1,187 @@
 # $FreeBSD$
 
 .PATH: ${LDRSRC} ${BOOTSRC}/libsa
 
 CFLAGS+=-I${LDRSRC}
 
 SRCS+=	boot.c commands.c console.c devopen.c interp.c 
 SRCS+=	interp_backslash.c interp_parse.c ls.c misc.c 
 SRCS+=	module.c nvstore.c pnglite.c
 
 CFLAGS.module.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 
 .PATH: ${SRCTOP}/contrib/pnglite
 CFLAGS.pnglite.c+= -I${SRCTOP}/contrib/pnglite
 CFLAGS.pnglite.c+= -DHAVE_MEMCPY -I${SRCTOP}/sys/contrib/zlib
 
 .if ${MACHINE} == "i386" || ${MACHINE_CPUARCH} == "amd64"
 SRCS+=	load_elf32.c load_elf32_obj.c reloc_elf32.c
 SRCS+=	load_elf64.c load_elf64_obj.c reloc_elf64.c
 CFLAGS.load_elf32.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 CFLAGS.load_elf64.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .elif ${MACHINE_CPUARCH} == "aarch64"
 SRCS+=	load_elf64.c reloc_elf64.c
 CFLAGS.load_elf64.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .elif ${MACHINE_CPUARCH} == "arm"
 SRCS+=	load_elf32.c reloc_elf32.c
 CFLAGS.load_elf32.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .elif ${MACHINE_CPUARCH} == "powerpc"
 SRCS+=	load_elf32.c reloc_elf32.c
 SRCS+=	load_elf64.c reloc_elf64.c
 SRCS+=	metadata.c
 CFLAGS.load_elf32.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 CFLAGS.load_elf64.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .elif ${MACHINE_ARCH:Mmips64*} != ""
 SRCS+= load_elf64.c reloc_elf64.c
 SRCS+=	metadata.c
 CFLAGS.load_elf64.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .elif ${MACHINE} == "mips"
 SRCS+=	load_elf32.c reloc_elf32.c
 SRCS+=	metadata.c
 CFLAGS.load_elf32.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .elif ${MACHINE_CPUARCH} == "riscv"
 SRCS+=	load_elf64.c reloc_elf64.c
 SRCS+=	metadata.c
 CFLAGS.load_elf64.c += -I$(SRCTOP)/sys/teken -I${SRCTOP}/contrib/pnglite
 .endif
 
 .if ${LOADER_DISK_SUPPORT:Uyes} == "yes"
 CFLAGS.part.c+= -DHAVE_MEMCPY -I${SRCTOP}/sys/contrib/zlib
 SRCS+=	disk.c part.c vdisk.c
 .endif
 
 .if ${LOADER_NET_SUPPORT:Uno} == "yes"
 SRCS+= dev_net.c
 .endif
 
 .if defined(HAVE_BCACHE)
 SRCS+=  bcache.c
 .endif
 
 .if defined(MD_IMAGE_SIZE)
 CFLAGS+= -DMD_IMAGE_SIZE=${MD_IMAGE_SIZE}
 SRCS+=	md.c
 .else
 CLEANFILES+=	md.o
 .endif
 
 # Machine-independant ISA PnP
 .if defined(HAVE_ISABUS)
 SRCS+=	isapnp.c
 .endif
 .if defined(HAVE_PNP)
 SRCS+=	pnp.c
 .endif
 
 .if ${LOADER_INTERP} == "lua"
 SRCS+=	interp_lua.c
 .include "${BOOTSRC}/lua.mk"
 LDR_INTERP=	${LIBLUA}
 LDR_INTERP32=	${LIBLUA32}
 CFLAGS.interp_lua.c= -DLUA_PATH=\"${LUAPATH}\" -I${FLUASRC}/modules
 .elif ${LOADER_INTERP} == "4th"
 SRCS+=	interp_forth.c
 .include "${BOOTSRC}/ficl.mk"
 LDR_INTERP=	${LIBFICL}
 LDR_INTERP32=	${LIBFICL32}
 .elif ${LOADER_INTERP} == "simp"
 SRCS+=	interp_simple.c
 .else
 .error Unknown interpreter ${LOADER_INTERP}
 .endif
 
-.if ${MK_LOADER_VERIEXEC} != "no"
-CFLAGS+= -DLOADER_VERIEXEC -I${SRCTOP}/lib/libsecureboot/h
-.if ${MK_LOADER_VERIEXEC_VECTX} != "no"
-CFLAGS+= -DLOADER_VERIEXEC_VECTX
-.endif
-.endif
-
-.if ${MK_LOADER_VERIEXEC_PASS_MANIFEST} != "no"
-CFLAGS+= -DLOADER_VERIEXEC_PASS_MANIFEST -I${SRCTOP}/lib/libsecureboot/h
-.endif
+.include "${BOOTSRC}/veriexec.mk"
 
 .if defined(BOOT_PROMPT_123)
 CFLAGS+=	-DBOOT_PROMPT_123
 .endif
 
 .if defined(LOADER_INSTALL_SUPPORT)
 SRCS+=	install.c
 .endif
 
 # Filesystem support
 .if ${LOADER_CD9660_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_CD9660_SUPPORT
 .endif
 .if ${LOADER_EXT2FS_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_EXT2FS_SUPPORT
 .endif
 .if ${LOADER_MSDOS_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_MSDOS_SUPPORT
 .endif
 .if ${LOADER_UFS_SUPPORT:Uyes} == "yes"
 CFLAGS+=	-DLOADER_UFS_SUPPORT
 .endif
 
 # Compression
 .if ${LOADER_GZIP_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_GZIP_SUPPORT
 .endif
 .if ${LOADER_BZIP2_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_BZIP2_SUPPORT
 .endif
 
 # Network related things
 .if ${LOADER_NET_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_NET_SUPPORT
 .endif
 .if ${LOADER_NFS_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_NFS_SUPPORT
 .endif
 .if ${LOADER_TFTP_SUPPORT:Uno} == "yes"
 CFLAGS+=	-DLOADER_TFTP_SUPPORT
 .endif
 
 # Partition support
 .if ${LOADER_GPT_SUPPORT:Uyes} == "yes"
 CFLAGS+= -DLOADER_GPT_SUPPORT
 .endif
 .if ${LOADER_MBR_SUPPORT:Uyes} == "yes"
 CFLAGS+= -DLOADER_MBR_SUPPORT
 .endif
 
 .if ${HAVE_ZFS:Uno} == "yes"
 CFLAGS+=	-DLOADER_ZFS_SUPPORT
 CFLAGS+=	-I${ZFSSRC}
 CFLAGS+=	-I${SYSDIR}/cddl/boot/zfs
 CFLAGS+=	-I${SYSDIR}/cddl/contrib/opensolaris/uts/common
 SRCS+=		zfs_cmd.c
 .endif
 
 LIBFICL=	${BOOTOBJ}/ficl/libficl.a
 .if ${MACHINE} == "i386"
 LIBFICL32=	${LIBFICL}
 .else
 LIBFICL32=	${BOOTOBJ}/ficl32/libficl.a
 .endif
 
 LIBLUA=		${BOOTOBJ}/liblua/liblua.a
 .if ${MACHINE} == "i386"
 LIBLUA32=	${LIBLUA}
 .else
 LIBLUA32=	${BOOTOBJ}/liblua32/liblua.a
 .endif
 
 CLEANFILES+=	vers.c
 VERSION_FILE?=	${.CURDIR}/version
 .if ${MK_REPRODUCIBLE_BUILD} != no
 REPRO_FLAG=	-r
 .endif
 vers.c: ${LDRSRC}/newvers.sh ${VERSION_FILE}
 	sh ${LDRSRC}/newvers.sh ${REPRO_FLAG} ${VERSION_FILE} \
 	    ${NEWVERSWHAT}
 
 .if ${MK_LOADER_VERBOSE} != "no"
 CFLAGS+=	-DELF_VERBOSE
 .endif
 
 .if !empty(HELP_FILES)
 HELP_FILES+=	${LDRSRC}/help.common
 
 CLEANFILES+=	loader.help
 FILES+=		loader.help
 
 loader.help: ${HELP_FILES}
 	cat ${HELP_FILES} | awk -f ${LDRSRC}/merge_help.awk > ${.TARGET}
 .endif
diff --git a/stand/veriexec.mk b/stand/veriexec.mk
new file mode 100644
index 000000000000..930e933be0a9
--- /dev/null
+++ b/stand/veriexec.mk
@@ -0,0 +1,9 @@
+.if ${MK_LOADER_VERIEXEC} != "no"
+CFLAGS+= -DLOADER_VERIEXEC -I${SRCTOP}/lib/libsecureboot/h
+.if ${MK_LOADER_VERIEXEC_VECTX} != "no"
+CFLAGS+= -DLOADER_VERIEXEC_VECTX
+.endif
+.if ${MK_LOADER_VERIEXEC_PASS_MANIFEST} != "no"
+CFLAGS+= -DLOADER_VERIEXEC_PASS_MANIFEST
+.endif
+.endif